CVE-2026-76184
Received Received - Intake

Path Traversal in Eclipse Jetty HttpClient

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-76184
EUVD
EUVD-2026-101946

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Eclipse Foundation Eclipse Jetty 12.1.0
Eclipse Foundation Eclipse Jetty 12.0.0
Eclipse Foundation Eclipse Jetty 11.0.0
Eclipse Foundation Eclipse Jetty 10.0.0
Eclipse Foundation Eclipse Jetty 9.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Eclipse Jetty's HttpClient allows scoped credentials to be leaked across path boundaries after a dot-segment redirect. When an attacker controls redirects, HttpClient matches cached credentials to a request using the raw, undecoded path before removing RFC 3986 dot segments. For example, a redirect to /secure/../evil incorrectly matches credentials for /secure, causing the Authorization header to be sent to /evil.

Detection Guidance

To detect this vulnerability, check if your system uses vulnerable versions of Eclipse Jetty HttpClient (9.4.0-9.4.64, 10.0.0-10.0.32, 11.0.0-11.0.32, 12.0.0-12.0.38, or 12.1.0-12.1.12). Review server logs for unusual redirects or credential leaks. Test with crafted redirects to see if credentials are sent to unintended paths.

Impact Analysis

An attacker could exploit this to obtain cached Basic credentials for a sibling path outside the intended protection scope, potentially exposing a username and password to a less-trusted application. This requires the attacker to have an application deployed on the same domain as the target.

Mitigation Strategies

Upgrade Eclipse Jetty HttpClient to patched versions (9.4.65, 10.0.33, 11.0.33, 12.0.39, or 12.1.13). Disable caching of credentials for redirects. Restrict same-origin redirects to trusted paths. Monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart